Bug#946783: debootstrap: cannot specify --foreign and --unpack-tarball at the same time

[Cel Skeggs <cela@mit.edu>]

Package: debootstrap
Version: 1.0.114
Severity: normal
Tags: patch

Dear Maintainer,

After upgrading to Buster, one of my scripts that uses debootstrap has stopped
working, specifically on a step that involves both the --foreign option and the
--unpack-tarball option.

Reproduction steps:

    $ sudo debootstrap --variant=minbase --make-tarball=test.tgz stretch test
    $ sudo debootstrap --variant=minbase --foreign --unpack-tarball=$PWD/test.tgz stretch test

When I run the second command, I get the following output:

   /usr/sbin/debootstrap: 266: [: --unpack-tarball=/homeworld/reproduce/test.tgz: unexpected operator
   E: --foreign is specified with --unpack-tarball=/homeworld/reproduce/test.tgz, please use only one of those options.

I would expect that these two options could be used together, and there appears
to be code provided in /usr/share/debootstrap/functions that would allow this
particular combination:

	########################################################### option handling
	check_conflicting_option () {
		if [ "$set_what_to_do" = --foreign ] && [ "${1%%=*}" = --unpack-tarball ] || \
		   [ "${set_what_to_do%%=*}" = "--unpack-tarball" ] && [ "$1" == --foreign ]; then
			LOOSEN_CONFLICTING_RESTRICTION="true"
		elif [ -n "$set_what_to_do" ]; then
			error 1 ARG_CONFLICTING "$set_what_to_do is specified with $1, please use only one of those options."
		fi
		set_what_to_do="$1"
	}

It seems to me that there are two bugs here:

   * sh's test builtin does not support '==', whereas bash's does, so the use
     of '==' causes the 'unexpected operator' error above.
   * sh's order of operations does not distinguish between && and ||, so the
     series of logical operators mean ((A && B) || C) && D, rather than
     (A && B) || (C && D).

I was able to solve this, at least for my use case, with the following patch:

--- /usr/share/debootstrap/functions	2019-12-15 14:20:12.689000000 -0500
+++ /usr/share/debootstrap/functions	2019-12-15 14:20:27.872000000 -0500
@@ -262,8 +262,8 @@
 
 ########################################################### option handling
 check_conflicting_option () {
-	if [ "$set_what_to_do" = --foreign ] && [ "${1%%=*}" = --unpack-tarball ] || \
-	   [ "${set_what_to_do%%=*}" = "--unpack-tarball" ] && [ "$1" == --foreign ]; then
+	if ( [ "$set_what_to_do" = --foreign ] && [ "${1%%=*}" = --unpack-tarball ] ) || \
+	   ( [ "${set_what_to_do%%=*}" = "--unpack-tarball" ] && [ "$1" = --foreign ] ); then
 		LOOSEN_CONFLICTING_RESTRICTION="true"
 	elif [ -n "$set_what_to_do" ]; then
 		error 1 ARG_CONFLICTING "$set_what_to_do is specified with $1, please use only one of those options."

I believe this bug was introduced by commit 25d80b10319ed292827d016bfea6edcdb51b9b52,
during the fix for bug #551838.

-- System Information:
Debian Release: 10.2
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.84-1.pvops.qubes.x86_64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: unable to detect

Versions of packages debootstrap depends on:
ii  wget  1.20.1-1.1

Versions of packages debootstrap recommends:
pn  arch-test               <none>
ii  debian-archive-keyring  2019.1
ii  gnupg                   2.2.12-1+deb10u1

Versions of packages debootstrap suggests:
pn  squid-deb-proxy-client  <none>
pn  ubuntu-archive-keyring  <none>

-- no debconf information